Going Passwordless Without the Cloud: Deploying an On-Premise FIDO2 Authentication Server

Oct 12, 2026

Achieving Passwordless Authentication Without the Cloud: Introducing vSEC Identity

The shift towards passwordless security is gaining momentum, with FIDO2 device-bound passkeys emerging as a modern approach to multi-factor authentication (MFA). However, for highly regulated industries such as defence, healthcare, and finance, adopting passwordless authentication presents a unique challenge: dependence on cloud-based identity providers (IdPs).

For organisations with strict data sovereignty requirements, moving authentication infrastructure to an external cloud provider may not be feasible. Compliance obligations, privacy regulations, and the need to operate in air-gapped environments make maintaining control over authentication data and infrastructure essential.

So, how can organisations implement FIDO2 device-bound passkey authentication without relying on a cloud identity provider?

One solution is to deploy an on-premises FIDO2 authentication server.

The Challenges of Cloud-Based Passkeys

Although major cloud providers have accelerated passkey adoption, their approaches may require organisations to depend on external identity infrastructure. For enterprises handling sensitive intellectual property or managing critical infrastructure, this can introduce several challenges.

  • Data Sovereignty: Organisations may have limited control over where authentication data is stored and processed when relying on external cloud identity providers.
  • Compliance Requirements: Air-gapped networks cannot connect to external endpoints, making cloud-dependent authentication unsuitable for certain environments.
  • Vendor Lock-In: Migrating away from a large cloud identity provider can become a complex and costly undertaking.

To strengthen security without compromising infrastructure control, organisations need an authentication solution that supports modern security standards while allowing them to retain ownership of their environment.

Introducing vSEC Identity: A Self-Managed MFA Server

With the release of vSEC 7.4, Versasec introduced vSEC Identity, an advanced multi-factor authentication server designed for deployment within an organisation's own infrastructure.

Whether deployed on-premises, in an air-gapped environment, or within a private cloud, vSEC Identity serves as a centralised authentication hub for protected web applications, REST APIs, and corporate web services.

How vSEC Identity Works

vSEC Identity is designed to integrate natively with an existing vSEC deployment rather than operate as a standalone identity provider.

1. Simplified Credential Issuance

During the initial credential issuance process, administrators or users through self-service can generate a device-bound FIDO2 passkey linked to vSEC Identity on their hardware token.

2. Standards-Based Authentication

When users access a protected web application, vSEC Identity authenticates them using WebAuthn and FIDO2 protocols through OpenID Connect (OIDC).

3. Full Control Over Authentication Data

Cryptographic keys, user mappings, and audit logs remain within the organisation's locally controlled environment, supporting its data sovereignty and security requirements.

Bridging the Gap Between Legacy and Modern Security

An on-premises FIDO2 authentication server enables organisations to modernise authentication without having to compromise their data governance requirements.

By extending an established credential management system to support passwordless authentication, organisations can simplify the login experience, eliminate vulnerable passwords, and help prevent phishing attacks while keeping their authentication infrastructure under their control.

Take Control of Your Authentication Infrastructure

Whether your organisation requires the data sovereignty of an on-premises deployment or the convenience of a managed solution through vSEC, Versasec offers FIDO2 credential management solutions designed to accommodate different compliance and operational requirements.

vSEC Identity is included for customers using vSEC Premium and vSEC, providing another option for organisations looking to advance their passwordless authentication strategy while maintaining control over their identity infrastructure.

About DT Asia

DT Asia began in 2007 with a clear mission to build the market entry for various pioneering IT security solutions from the US, Europe and Israel.

Today, DT Asia is a regional, value-added distributor of cybersecurity solutions providing cutting-edge technologies to key government organisations and top private sector clients including global banks and Fortune 500 companies. We have offices and partners around the Asia Pacific to better understand the markets and deliver localised solutions.

How we help

If you need to know more about Going Passwordless Without the Cloud: Deploying an On-Premise FIDO2 Authentication Server, you’re in the right place, we’re here to help! DTA is Versasec’s distributor, especially in Singapore and Asia, our technicians have deep experience on the product and relevant technologies you can always trust, we provide this product’s turnkey solutions, including consultation, deployment, and maintenance service.

Click here and here and here to know more: https://dtasiagroup.com/versasec/